When your credit card expires, you simply replace it with a new one and forget about it. What could go wrong? Plenty, it turns out. Researchers have discovered a new loophole that can bring expired credit cards – stolen or, yes, even replaced – back to life. That’s a gift to fraudsters.

According to a new study by researchers from the University of Massachusetts Amherst, these “zombie credit cards” could leave cardholders vulnerable to fraudulent charges.

The loophole exists because credit card accounts don’t actually expire with the physical card. A good example: if you’re returning whatever you purchased, your account will be refunded – even if the purchasing credit card has expired.

This made Taqi Raza, assistant professor in the Riccio College of Engineering at the university, wonder: “If the card can get a refund, can the card make a payment?”

It turns out that the answer is yes, at least for some credit cards. At the USENIX Security 2026 conference, Raza and his team explained how they devised a system using 2 brand new smartphones and basic emulator software to fool an in-store card reader into thinking a card was active.

Using the same technology that enables tap-to-pay NFC transactions, the first phone is used to activate the credit card.

The phone “tells” the card: a purchase is trying to be made, so send over the cardholder data and payment application. This includes the past-due expiration date.

But then the second phone, using a “man-in-the-middle” WiFi-based relay system, takes the credit card information, rewriting the expiration date.

According to Raja Hasnain Anwar, the lead author of the study, this type of attack is particularly dangerous since the crooks don’t really need to know the actual expiration date of a replacement card – any arbitrary expiration date in the future is sufficient to successfully make a charge.

The expiration date printed and stored on the card is the only way for the card reader to know whether the card is active or expired. Yet it is not cryptographically protected. So we can easily modify it to fool the point-of-sale terminal,

says Raja Hasnain Anwar, the lead author of the study.

Next, this second phone is tapped to the card reader, and since not all banks verify the terminal-read expiration date against authenticated data, the fraudulent transaction will be successful – if other measures aren’t in place to recheck card lifecycle status, of course.

In fact, credit cards have another expiration date in addition to the one printed on your card: a date embedded in the security key that encrypts the transaction between the card and the bank. This digital certificate is checked first, enabling the card to “talk” to the POS.

“What we found is that the expiry date for the digital certificate for the security key is longer than the expiry date of the return on the card,” says Raza.

What it means is that this date is an ineffective check of the card’s actual expiration status.

The researchers demonstrated that this loophole works both in the lab and in the wild – for example, at local dining facilities and grocery stores.

“With the rise of AI, it is becoming increasingly easy for attackers to spot these discrepancies and devise exploits, effectively putting millions of credit cards at risk,” says Anwar.

The advice is to always discard your expired card – no matter what. One should demagnetize the card, destroy the embedded chip with a hammer or scissors, cut the card apart, and, finally, separate the credit card pieces into different trash cans.